In this article I will explain with example how to implement simple user login form in ASP.Net using C# and VB.Net.
The login form has been implemented using ASP.Net controls and Forms Authentication. It also has the Remember Me CheckBox feature which allows user to save the credentials when he visits site next time.
Note: This is the third article from the series, in my previous articles I have explained Simple User Registration Form Example in ASP.Net and Send User Confirmation email after Registration with Activation Link in ASP.Net.
 
 

Database

I am making use of the same database table Users which was used in the article Simple User Registration Form Example in ASP.Net.
Simple User Login Form example in ASP.Net
 
Note: The SQL for creating the database is provided in the attached sample code.
 
This example consists of two pages Login page (Login.aspx) using which the user will login and the Landing page (Home.aspx) which is the page user will be redirected after successful authentication.
 
 

Login Page

This is the login form which will do the following:-
1. Authenticate user by verifying Username and Password.
2. Make sure user has activated his account. Refer my article for details Send User Confirmation email after Registration with Activation Link in ASP.Net.
 
 

HTML Markup

The HTML markup consists of an ASP.Net Login control for which the OnAuthenticate event handler has been specified.
<form id="form1" runat="server">
    <asp:Login ID="userLogin" runat="server" OnAuthenticate="ValidateUser"></asp:Login>
</form>
 
Simple User Login Form example in ASP.Net
 
 

Namespaces

You will need to import the following namespaces.
C#
using System.Data;
using System.Data.SqlClient;
using System.Configuration;
using System.Web.Security;
 
VB.Net
Imports System.Data
Imports System.Data.SqlClient
Imports System.Configuration
Imports System.Web.Security
 
 

Stored Procedure to Validate the User Credentials

The following stored procedure is used to validate the user credentials, this stored procedure first checks whether the username and password are correct else returns -1.
If the username and password are correct but the user has not been activated, then the code returned is -2.
If the username and password are correct and the user account has been activated, then UserId of the user is returned by the stored procedure.
CREATE PROCEDURE [dbo].[Validate_User]
    @Username NVARCHAR(20),
    @Password NVARCHAR(20)
AS
BEGIN
    SET NOCOUNT ON;
    DECLARE @UserId INT, @LastLoginDate DATETIME
    SELECT @UserId = UserId, @LastLoginDate = LastLoginDate
    FROM Users WHERE Username = @Username AND [Password] = @Password
    IF @UserId IS NOT NULL
    BEGIN
        IF NOT EXISTS(SELECT UserId FROM UserActivation WHERE UserId = @UserId)
        BEGIN
            UPDATE Users
            SET LastLoginDate = GETDATE()
            WHERE UserId = @UserId
            SELECT @UserId [UserId] -- User Valid
        END
        ELSE
        BEGIN
            SELECT -2 -- User not activated.
        END
    END
    ELSE
    BEGIN
        SELECT -1 -- User invalid.
    END
END
 
 

Validating the User Credentials

The below event handler gets called when the Log In button is clicked. Here the Username and Password entered by the user is passed to the stored procedure and its status is captured and if the value is not -1 (Username or password incorrect) or -2 (Account not activated) then the user is redirected to the Home page using FormsAuthentication RedirectFromLoginPage method.
C#
protected void ValidateUser(object sender, EventArgs e)
{
    int userId = 0;
    string spName  = "Validate_User";
    string constr = ConfigurationManager.ConnectionStrings["constr"].ConnectionString;
    using (SqlConnection con = new SqlConnection(constr))
    {
        using (SqlCommand cmd = new SqlCommand(spName, con))
        {
            cmd.CommandType = CommandType.StoredProcedure;
            cmd.Parameters.AddWithValue("@Username", userLogin.UserName);
            cmd.Parameters.AddWithValue("@Password", userLogin.Password);
            con.Open();
            userId = Convert.ToInt32(cmd.ExecuteScalar());
            con.Close();
        }
        switch (userId)
        {
            case -1:
                userLogin.FailureText = "Username and/or password is incorrect.";
                break;
            case -2:
                userLogin.FailureText = "Account has not been activated.";
                break;
            default:
                FormsAuthentication.RedirectFromLoginPage(userLogin.UserName, userLogin.RememberMeSet);
                break;
        }
    }
}
 
VB.Net
Protected Sub ValidateUser(sender As Object, e As EventArgs)
    Dim userId As Integer = 0
    Dim spName As String = "Validate_User"
    Dim constr As String = ConfigurationManager.ConnectionStrings("constr").ConnectionString
    Using con As New SqlConnection(constr)
        Using cmd As New SqlCommand(spName, con)
            cmd.CommandType = CommandType.StoredProcedure
            cmd.Parameters.AddWithValue("@Username", userLogin.UserName)
            cmd.Parameters.AddWithValue("@Password", userLogin.Password)
            con.Open()
            userId = Convert.ToInt32(cmd.ExecuteScalar())
            con.Close()
        End Using
        Select Case userId
            Case -1
                userLogin.FailureText = "Username and/or password is incorrect."
                Exit Select
            Case -2
                userLogin.FailureText = "Account has not been activated."
                Exit Select
            Case Else
                FormsAuthentication.RedirectFromLoginPage(userLogin.UserName, userLogin.RememberMeSet)
                Exit Select
        End Select
    End Using
End Sub
 
 

Home Page

After successful login user will be redirected to this page.
 
 

HTML Markup

In this page I have made use of ASP.Net LoginName control to display the name of the Logged In user and LoginStatus control to allow user Logout.
<div>
    Welcome
    <asp:LoginName ID="LoginName" runat="server" Font-Bold="true" />
    <br />
    <br />
    <asp:LoginStatus ID="LoginStatus" runat="server" />
</div>
 
Simple User Login Form example in ASP.Net
 
 

Verify whether User has Logged In

Inside the Page Load event, first we verify whether the User is authenticated using the IsAuthenticated property. If the user is not authenticated, then he is redirected back to the Login page using FormsAuthentication RedirectToLoginPage method.
C#
protected void Page_Load(object sender, EventArgs e)
{
    if (!this.Page.User.Identity.IsAuthenticated)
    {
        FormsAuthentication.RedirectToLoginPage();
    }
}
 
VB.Net
Protected Sub Page_Load(ByVal sender As Object, ByVal e As EventArgs) Handles Me.Load
    If Not Me.Page.User.Identity.IsAuthenticatedThen
        FormsAuthentication.RedirectToLoginPage()
    End If
End Sub
 
 

Web.Config Configuration

You will need to add the following configuration in the Web.Config file in the section.
<authentication mode= "Forms">
<forms defaultUrl= "~/Home.aspx" loginUrl= "~/Login.aspx" slidingExpiration= "true" timeout= "2880"/>
</authentication>
 
 

Downloads

Download Code